fix: get all imported challenges building and running

Root causes found by prebuilding every challenge image in parallel:
- fjb: ghcr.io base is not anonymously pullable here -> official httpd:2.4.
  pnpm 12 (via corepack on node:20) fails the install with
  ERR_PNPM_IGNORED_BUILDS unless build scripts are approved; neither
  onlyBuiltDependencies in pnpm-workspace.yaml nor --no-ignore-scripts
  suppresses it. The working sequence is:
    pnpm install --ignore-scripts && pnpm approve-builds --all && pnpm rebuild
- xl + kode-viewer: node:20-slim-bookworm is not a real tag -> node:20-bookworm-slim.
- burvesigner: python-dev no longer exists in bookworm -> dropped (python3-dev
  was already there and the source has no py2 syntax).
- burvesigner/hirnfick/s3: apt update and install were separate RUN layers;
  with the bundled apt-insecure.conf the second invocation re-resolved against
  the EOL bullseye-security mirror and 404'd every package. Merged into one
  'update && install' layer (fix_apt_layers.py, idempotent).
- consolidate_images.sh: teams used to build a private image per team
  (team1-x ... team4-x) because no shared image existed. Since the password is
  applied at runtime via chpasswd, one shared services-<name> build is enough;
  this reclaims ~1.5 GB, which matters on a 79 GB disk.
- reconcile_team_state(): a challenge enabled while a team was down left
  state.json without ports/flag/password, so the next compose render died with
  KeyError. Now both the API and the CLI tools reconcile first.

services/fjb/Dockerfile

@@ -7,9 +7,17 @@ RUN corepack enable
 
 WORKDIR /app
 
-COPY ./frontend/pnpm-workspace.yaml /app/
-COPY ./frontend/package.json ./frontend/pnpm-lock.yaml /app/
-RUN pnpm install --frozen-lockfile
+# pnpm >=10 blocks dependency lifecycle scripts by default and then FAILS the
+# install with ERR_PNPM_IGNORED_BUILDS (pnpm 12 still does this even with
+# onlyBuiltDependencies in pnpm-workspace.yaml, and --no-ignore-scripts does not
+# suppress the error either). esbuild's postinstall places the platform binary
+# the Vite build needs, so approve pending build scripts non-interactively.
+# --frozen-lockfile is dropped because the added config keys change the lockfile
+# hash and would fail the install outright.
+COPY ./frontend/pnpm-workspace.yaml ./frontend/package.json ./frontend/pnpm-lock.yaml /app/
+RUN pnpm install --ignore-scripts \
+ && pnpm approve-builds --all \
+ && pnpm rebuild
 
 FROM base AS build